Email or username:

Password:

Forgot your password?
Simon's posts Post Back to profile
Simon Willison

The piece of documentation I want most for the modern web is something that explains to me what variants of a "set-cookie:" header work in which modern browsers under which conditions

There's a ton of stuff out there about "Total Cookie Protection" in Firefox and "Privacy Sandbox" in Chrome, but I cannot figure out what it actually means for me as a web developer! I need protocol-level documentation for all of this stuff.

29 August at 18:55 | Open on fedi.simonwillison.net
17 comments
Simon Willison

A few years ago I put a bunch of work into figuring out the SameSite cookie attribute because the documentation for how that actually worked was so thin on the ground simonwillison.net/2021/Aug/3/s

29 August at 18:56 | Open on fedi.simonwillison.net
Ian

@simon I was literally sweating these details yesterday when Hono, a lightweight JS framework, wouldn't write signed cookies and I though it might be the sameSite.

29 August at 19:40 | Open on hachyderm.io
Bill Seitz

@simon I think the CORS doc you linked to recently also included info on cookies

29 August at 19:46 | Open on toolsforthought.social
Evil Jim O’Donnell

@simon thanks for this. I was actually wondering, today, whether I’m using SameSite correctly in a PR.

github.com/zooniverse/front-en

29 August at 20:32 | Open on mastodon.social
Simon Willison

I just read the FAQ for Firefox "Total Cookie Protection" and I am sadly no closer to understanding what impact Total Cookie Protection has on how I should build web applications - I'm particularly interested in understanding how it impacts things like OAuth SSO support.mozilla.org/en-US/kb/t

29 August at 21:15 | Open on fedi.simonwillison.net
Russ Garrett

@simon OAuth doesn't use third-party cookies so I believe it's all good. The problem is with SSO systems which use third-party cookies to transparently log you in across several domains.

29 August at 21:34 | Open on chaos.social
Simon Willison

@russss aaah gotcha - that’s the thing that caused the Chrome team to implement their weird 2-minute twist simonwillison.net/2021/Aug/3/s

29 August at 21:44 | Open on fedi.simonwillison.net
kellan

@simon total cookie protection makes me think about the wax paper between layers of Xmas cookie in the cookie tin

29 August at 21:43 | Open on fiasco.social
baconandcoconut
Jeffrey Yasskin

@simon There's some work going on at johannhof.github.io/draft-anne to specify this. Does that draft at least improve the situation? I believe they're accepting complaints and suggestions.

29 August at 19:02 | Open on hachyderm.io
Simon Willison

@jyasskin that looks great! The thing that's missing is exact documentation as to which version of which browsers implement which policies - three years ago I was having trouble figuring out which browsers had actually implemented SameSite=lax by default, the situation on that is no better today!

29 August at 19:04 | Open on fedi.simonwillison.net
Jeffrey Yasskin

@simon I think caniuse.com/mdn-http_headers_s answers that question? I haven't checked that it's correct, but generally it'd be nice for `caniuse` to answer questions about how completely each browser implements consensus and proposed standards.

29 August at 19:13 | Open on hachyderm.io
Simon Willison

@jyasskin sadly that doesn’t cover the deeper issue of what happens if you send set-cookie without a SameSite attribute at all - or weird undocumented edge-cases like what changes if a Safari user turns on “Prevent Cross-Site Tracking”
29 August at 19:17 | Open on fedi.simonwillison.net
Jeffrey Yasskin

@simon My understanding of "Defaults to Lax" is that it's a description of what happens "if you send set-cookie without a SameSite attribute at all", but I admit that I don't know what the maintainers are actually testing when they update this entry, and I can't find any documentation that says explicitly.

+1 that user settings are much less evenly covered, although there's a field for it in the data format that's used for the Firefox setting: github.com/mdn/browser-compat-.

@simon My understanding of "Defaults to Lax" is that it's a description of what happens "if you send set-cookie without a SameSite attribute at all", but I admit that I don't know what the maintainers are actually testing when they update this entry, and I can't find any documentation that says explicitly.

29 August at 19:29 | Open on hachyderm.io
Melaskia

@simon Well, a very stupid summary with some elements of wrong.
1st party cookies with controlled subdomain and permissions will be fine.
The rest, notably 3rd party cookies are going to be very difficult (especially for FF and Safari since Chrome has kinda given up).

29 August at 19:19 | Open on mastodon.social
Simon Willison

@Melaskia I’ll be honest: I don’t even completely understand what the term “third party cookie” means at the level of sending set-cookie headers!

29 August at 19:30 | Open on fedi.simonwillison.net
Melaskia

@simon A first party cookie is when the website sends a cookie for its corresponding domain.
A Third party cookie is when you have a library (like GA) trying to set up a cookie on a separate domain.
Third party cookie will usually last until the active session of the browser or some expiry time deciding by the browser.

29 August at 22:19 | Open on mastodon.social
Go Up